Mendix incident
Security update: compromised eMudhra certificates blocked for Mendix Cloud apps
Ongoing since 06:59 PM UTC, affecting Mendix Cloud US-East and Mendix Cloud EU (Frankfurt) and 1 more.
What happened A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling. Who is affected Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected. What we did We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included. What you need to do The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough. If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production: 1. Test environment 2. Acceptance environment 3. Production environment If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment. A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you. What to expect after redeploying If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate. If you have any questions, feel free to contact support.
Affected components
Update timeline
- monitoring Oct 22, 2026, 06:59 PM UTC
What happened A certificate authority called eMudhra generated the cryptographic keys for eight of its intermediate certificates incorrectly, that caused the certificates to become compromised. This is tracked as CVE-2026-91403. Java, which Mendix apps run on, trusted these certificates by default. Someone able to intercept an app's outgoing connection could pose as the server it was calling. Who is affected Only the outgoing connections your app makes over HTTPS, for example REST or web service calls, or other integrations with external systems. Traffic coming in to your app, such as users opening it in a browser, is not affected. What we did We have updated the Mendix Cloud build process so that apps built from now on no longer trust the compromised certificates. We have also updated the underlying OS base image. This was released on 22 Oct at 17:30 UTC. Tomorrow we will do another update to get the latest Java/JRE releases included. What you need to do The fix is added when your app is built, so apps that are already running only get it when you redeploy. A restart is not enough. If your app makes outgoing calls to other systems, please redeploy it. We recommend doing this in your usual order, so you can check that your integrations still work before production: 1. Test environment 2. Acceptance environment 3. Production environment If your app does not make outgoing calls, no action is needed. It will receive the update at its next regular deployment. A redeploy causes a short downtime while the app restarts, so you can plan it in a window that suits you. What to expect after redeploying If one of the systems your app calls uses a certificate issued by one of the affected eMudhra authorities, the connection will now fail. In that case, ask the owner of that system to replace its certificate. If you have any questions, feel free to contact support.
Your product runs on more than Mendix
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services